Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    10-03-2023 06:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0062734a275ffb573ba0289ee6d876d288890b69d731400f47fd3ae9cb8144d6.exe

  • Size

    328KB

  • MD5

    3e83a743b35142731f4204df90f085c5

  • SHA1

    ef36ffe379eeb71d301ff2aae3d72254f794a78d

  • SHA256

    0062734a275ffb573ba0289ee6d876d288890b69d731400f47fd3ae9cb8144d6

  • SHA512

    431efa5d053dd3e03eb3c5cfaa728f685569b416e6699449fe2248fa737e2cdeb110398674beeb43bfdab22e2b2d7e45c9c9e091aa97d81f6ee508153153b9fa

  • SSDEEP

    6144:evSBanJK/5kPas8N0HEAAf1vbViarAWbd33eEPT:evjas8uHEAAtvBpkrEPT

Score
10/10
pseudomanuscryptloader

Malware Config

Signatures

  • Detects PseudoManuscrypt payload 28 IoCs
    loader
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • PseudoManuscrypt

    PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.

    loaderpseudomanuscrypt
  • Loads dropped DLL 1 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1020
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1084
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Themes
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1260
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1216
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1412
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s SENS
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1492
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1932
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2288
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2480
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k WspService
      2⤵
      • Drops file in System32 directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1612
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2328
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2572
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2596
  • C:\Users\Admin\AppData\Local\Temp\0062734a275ffb573ba0289ee6d876d288890b69d731400f47fd3ae9cb8144d6.exe
    "C:\Users\Admin\AppData\Local\Temp\0062734a275ffb573ba0289ee6d876d288890b69d731400f47fd3ae9cb8144d6.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4148
    • C:\Users\Admin\AppData\Local\Temp\0062734a275ffb573ba0289ee6d876d288890b69d731400f47fd3ae9cb8144d6.exe
      "C:\Users\Admin\AppData\Local\Temp\0062734a275ffb573ba0289ee6d876d288890b69d731400f47fd3ae9cb8144d6.exe" -h
      2⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3592
  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:4836
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4268

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\db.dat
    Filesize

    557KB

    MD5

    fd90f85bea1392578bc903144ace2ace

    SHA1

    0eabae72ab684584ca78dce7680fb997d7aba07b

    SHA256

    32e932155cf3f208d90aa0a058a87cf072e54e38e8c5c22c045411bac0bf936d

    SHA512

    6de4887f177d71e21b89c9d431244044b50f3bb994939690413e77775dcc17b06a4dc11c7f5b1f6f382459e12bc9800fbba81fc54f41a4dbe77e5b52c90c4151

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\db.dll
    Filesize

    52KB

    MD5

    1b20e998d058e813dfc515867d31124f

    SHA1

    c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

    SHA256

    24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

    SHA512

    79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

    Download Submit
  • \Users\Admin\AppData\Local\Temp\db.dll
    Filesize

    52KB

    MD5

    1b20e998d058e813dfc515867d31124f

    SHA1

    c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

    SHA256

    24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

    SHA512

    79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

    Download Submit
  • memory/1020-132-0x000001B955E70000-0x000001B955EE2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1020-149-0x000001B955E70000-0x000001B955EE2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1084-167-0x00000298E9D40000-0x00000298E9DB2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1084-201-0x00000298E9D40000-0x00000298E9DB2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1216-199-0x000001A918660000-0x000001A9186D2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1216-161-0x000001A918660000-0x000001A9186D2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1260-208-0x000001F32BCB0000-0x000001F32BD22000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1260-186-0x000001F32BCB0000-0x000001F32BD22000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1412-210-0x000001D88E860000-0x000001D88E8D2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1412-193-0x000001D88E860000-0x000001D88E8D2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1492-203-0x000001F939670000-0x000001F9396E2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1492-173-0x000001F939670000-0x000001F9396E2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1612-242-0x000002991DBC0000-0x000002991DBDB000-memory.dmp
    Filesize

    108KB

    Download
  • memory/1612-150-0x000002991C340000-0x000002991C3B2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1612-133-0x000002991C340000-0x000002991C3B2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1612-226-0x000002991C340000-0x000002991C3B2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1612-239-0x000002991DB60000-0x000002991DB7B000-memory.dmp
    Filesize

    108KB

    Download
  • memory/1612-142-0x000002991C340000-0x000002991C3B2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1612-255-0x000002991E800000-0x000002991E90B000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/1612-240-0x000002991E800000-0x000002991E90B000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/1612-241-0x000002991DB80000-0x000002991DBA0000-memory.dmp
    Filesize

    128KB

    Download
  • memory/1932-180-0x000001F4C5470000-0x000001F4C54E2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1932-206-0x000001F4C5470000-0x000001F4C54E2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2288-141-0x00000195F6480000-0x00000195F64F2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2288-152-0x00000195F6480000-0x00000195F64F2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2328-154-0x000001A5B7130000-0x000001A5B71A2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2328-198-0x000001A5B7130000-0x000001A5B71A2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2480-147-0x0000027B05D00000-0x0000027B05D72000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2480-121-0x0000027B05B10000-0x0000027B05B5D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/2480-124-0x0000027B05D00000-0x0000027B05D72000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2480-126-0x0000027B05B10000-0x0000027B05B5D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/2572-223-0x000001F9B9940000-0x000001F9B99B2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2572-202-0x000001F9B9940000-0x000001F9B99B2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2596-224-0x000001C2FDD00000-0x000001C2FDD72000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2596-214-0x000001C2FDD00000-0x000001C2FDD72000-memory.dmp
    Filesize

    456KB

    Download
  • memory/4268-145-0x0000000004300000-0x000000000435E000-memory.dmp
    Filesize

    376KB

    Download
  • memory/4268-144-0x0000000004460000-0x000000000456C000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/4268-219-0x0000000004300000-0x000000000435E000-memory.dmp
    Filesize

    376KB

    Download